EU General Data Protection Research Articles

Why data about people are so hard to govern

AbstractHow data on individuals are gathered, analyzed, and stored remains largely ungoverned at both domestic and global levels. We address the unique governance problem posed by digital data to provide a framework for understanding why data governance remains elusive. Data are easily transferable and replicable, making them a useful tool. But this characteristic creates massive governance problems for all of us who want to have some agency and choice over how (or if) our data are collected and used. Moreover, data are co‐created: individuals are the object from which data are culled by an interested party. Yet, any data point has a marginal value of close to zero and thus individuals have little bargaining power when it comes to negotiating with data collectors. Relatedly, data follow the rule of winner take all—the parties that have the most can leverage that data for greater accuracy and utility, leading to natural oligopolies. Finally, data's value lies in combination with proprietary algorithms that analyze and predict the patterns. Given these characteristics, private governance solutions are ineffective. Public solutions will also likely be insufficient. The imbalance in market power between platforms that collect data and individuals will be reproduced in the political sphere. We conclude that some form of collective data governance is required. We examine the challenges to the data governance by looking a public effort, the EU's General Data Protection Regulation, a private effort, Apple's “privacy nutrition labels” in their App Store, and a collective effort, the First Nations Information Governance Centre in Canada.

The effect of privacy regulation on the data industry: empirical evidence from GDPR

AbstractUtilizing a novel dataset from an online travel intermediary, we study the effects of the EU's General Data Protection Regulation (GDPR). The opt‐in requirement of GDPR resulted in a 12.5% drop in the intermediary‐observed consumers, but the remaining consumers are trackable for a longer period of time. Our findings imply that privacy‐conscious consumers exert privacy externalities on opt‐in consumers, making them more predictable. Consistent with this finding, the average value of the remaining consumers to advertisers has increased, offsetting some of the losses from consumer opt‐outs.

Contextualizing privacy with wearable data in higher education

AbstractThis conceptual study uses dynamic systems theory (DST) and phenomenology as lenses to examine data privacy implications surrounding wearable devices that incorporate stakeholder, contextual and technical factors. Wearable devices can impact people's behaviour and sense of self, and DST and phenomenology provide complementary approaches for emphasizing the subjective experiences of individuals that occur with the use of wearable data. Privacy is approached through phenomenology as an individual's lived bodily experience and DST emphasizes the self‐regulation and feedback loops of individuals and their uses of wearable data. The data collection, analysis and communication of wearable data to support learning systems alongside privacy implications for each are examined. The IoT, cloud computing, metadata and algorithms are discussed as they relate to wearable data, pointing out privacy risks and strategies to minimize harm. Practitioner notesWhat is already known about this topic Data privacy is a complex topic and is approached through different perspectives, influencing the degree of an individual's data autonomy. Wearable technology is increasing in the consumer market and offers great potential to learning environments. What this paper adds Extends extant literature on dynamic systems theory and phenomenology, contributing these perspectives to educational research in the context of student data privacy and wearable technologies. Provides a framework to understand the complex and contingent ways that privacy can be understood in the collection, analysis, and communication of wearable data to support learning. Implications for practice and/or policy Higher education faculty and educational policymakers should consider various interactions in systems and among systems of how wearable data collection may be analysed, communicated and stored, potentially exposing students to privacy harms. Multiple actors in learning systems must engage in continuous and evolving feedback loops around data security, consent, ownership and control to determine who has access to student data, how it is used and for what purposes. The EU's General Data Protection and Regulation offers one of the most comprehensive frameworks for higher education institutions and faculty around the world to follow for protecting student data privacy.

Gaps, guesswork, and ghosts lurking in technology integration: Laws and policies applicable to student privacy

Technology integration and learning analytics offer insights to improve educational experiences and outcomes. In advancing these efforts, laws and policies govern these environments placing protections, standards, and developmental opportunities for higher education, students, faculty, and even the nation‐state. Nonetheless, evidence of educational restrictions, encumbered actions, and archaic approaches pervades the legal literature and case law demonstrating that these laws and policies do not always function well in evolving and emerging technology spaces. To examine these laws and policies of student privacy, the author employs the combination of a critical policy analysis, which derives from critical social research as a means to explore discourse and policy through drawing out the policy contexts, texts, and consequences, and Flood's liberating systems theory, which directs the analysis to a problem‐solving approach by examining the policy discourse from a systems‐thinking lens. Based on a review of 184 court cases, 74 policies from a diversified representation of US states/territories, and seven developed nations or multi‐nation consortia, this examination illuminates how context and text such as the type and setting of the privacy matter (eg, various freedom of information acts, educational records under the Family Educational Rights and Privacy Act, and General Data Protection Regulation in the European Union) presents opportunities for protections and standardization efforts; however, they also illustrate significant protection gaps, guesswork and insufficiency around the type and degree of data subject consent, and ghosting effects of data subjects' protections. While the extant literature already supports aspects of these findings, it does not account for this holistic view of these three privacy vulnerabilities—especially in light of the principles to which these laws purport to achieve. Moreover, the three identified privacy vulnerabilities suggest overlooked inclusion of two overarching privacy concepts—transparency and equity. This study recommends that key actors in the policy construction realm (ie, university leaders, policymakers, and judges) should engage in analyses, dialogue, and consideration about transparency and equity by considering contemporary privacy problems in the contexts of artificial intelligence, quantum computing, and cybersecurity as a way to improve transparent and equitable policies in these areas rather than exacerbating the privacy dilemmas already in place. Practitioner notesWhat is already known about this topic In the United States, the Family Educational Rights and Privacy Act of 1974 (FERPA) and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) are well documented evidence of privacy protections for education and health records, but they fail to offer sufficient protections for students as data subjects with emerging technologies. Existing federal‐level laws in the United States do not offer a systematic or uniform approach in the manner that data users obtain consent, so data subjects are largely unaware of what is being consented. Other than matters of consent, policy strategies based on student privacy laws (ie, voluntary consensus standards, basic practices to maintain privacy, an ethics review board, data/record retention and destruction, and data sanitation of equipment) are significant and informative largely from the university‐perspective, not the students as data subjects. What this paper adds A new comprehensive examination of US laws including statutes, regulations, and cases as well as seven key nation‐state or national consortia laws—especially the EU's General Data Protection Regulation and selected state laws in the United States, which offer consistent and greater student privacy protections. Insights about the principles designed among the laws, which centre around their application, essentiality, consent, and security. Attention to areas in which student privacy laws still present privacy concerns, but specifically identifying issues of significant gaps, guesswork and insufficiency around levels and types of consent, and ghosting effects of data subjects' protections. Implications for practice and/or policy Data subject consent should be established and consistent– whether an opt‐out provision, opt‐in provision, or some extensive engagement. Student privacy policies should incorporate principles of transparency and equity for data subjects and data treatment. Policymakers should consider now how the intersections of data subject privacy matters shall be addressed in the context of artificial intelligence, quantum computing, and cybersecurity.

The thin red line: Refocusing data protection law on ADM, a global perspective with lessons from case-law

This article explores existing data protection law provisions in the EU and in six other jurisdictions from around the world - with a focus on Latin America - that apply to at least some forms of the processing of data typically part of an Artificial Intelligence (AI) system. In particular, the article analyzes how data protection law applies to “automated decision-making” (ADM), starting from the relevant provisions of EU's General Data Protection Regulation (GDPR). Rather than being a conceptual exploration of what constitutes ADM and how “AI systems” are defined by current legislative initiatives, the article proposes a targeted approach that focuses strictly on ADM and how data protection law already applies to it in real life cases. First, the article will show how GDPR provisions have been enforced in Courts and by Data Protection Authorities (DPAs) in the EU, in numerous cases where ADM is at the core of the facts of the case considered. After showing that the safeguards in the GDPR already apply to ADM in real life cases, even where ADM does not meet the high threshold in its specialized provision in Article 22 (“solely” ADM which results in “legal or similarly significant effects” on individuals), the article includes a brief comparative law analysis of six jurisdictions that have adopted general data protection laws (Brazil, Mexico, Argentina, Colombia, China and South Africa) and that are visibly inspired by GDPR provisions or its predecessor, Directive 95/46/EC, including those that are relevant for ADM. The ultimate goal of this study is to support researchers, policymakers and lawmakers to understand how existing data protection law applies to ADM and profiling.11The authors thank the reviewers of the CPDP Latin America 2022 Conference and this journal for their suggestions to improve the draft paper. We also thank our colleague Stefania Medrano for her research and translation support into Latin American jurisdictions.

Privacy Legislation as Business Risks: How GDPR and CCPA are Represented in Technology Companies' Investment Risk Disclosures

Power exercised by large technology companies has led to concerns over privacy and data protection, evidenced by the passage of legislation including the EU's General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). While much privacy research has focused on how users perceive privacy and interact with companies, we focus on how privacy legislation is discussed among a different set of relationships-those between companies and investors. This paper investigates how companies translate the GDPR and CCPA into business risks in documents created for investors. We conduct a qualitative document analysis of annual regulatory filings (Form 10-K) from nine major technology companies. We outline five ways that technology companies consider GDPR and CCPA as business risks, describing both direct and indirect ways that the legislation may affect their businesses. We highlight how these findings are relevant for the broader CSCW and privacy research communities in research, design, and practice. Creating meaningful privacy changes within existing institutional structures requires some understanding of the dynamics of these companies' decision-making processes and the role of capital.

Towards a Toolbox for Privacy-Preserving Computation on Health Data.

Substantial advances in methods of collecting and aggregating large amounts of biomedical data have been met with insufficient measures of protecting it from unwarranted access and use. Most of the current layers of protection are merely aimed at ensuring compliance with regulations (e.g., the EU's General Data Protection Regulation) but do not represent a vision of privacy-by-design as an efficient and ethical advantage in biomedical research and clinical applications. This not only slows down the pace of such efforts but also leaves the data exposed to a wide spectrum of cyberattacks. This work presents an overview of recent advancements in data and compuation security, along with a discussion of their limitations and potential for deployement in both health care and research settings.

The Issue of Proxies and Choice Architectures. Why EU Law Matters for Recommender Systems.

Recommendations are meant to increase sales or ad revenue, as these are the first priority of those who pay for them. As recommender systems match their recommendations with inferred preferences, we should not be surprised if the algorithm optimizes for lucrative preferences and thus co-produces the preferences they mine. This relates to the well-known problems of feedback loops, filter bubbles, and echo chambers. In this article, I discuss the implications of the fact that computing systems necessarily work with proxies when inferring recommendations and raise a number of questions about whether recommender systems actually do what they are claimed to do, while also analysing the often-perverse economic incentive structures that have a major impact on relevant design decisions. Finally, I will explain how the choice architectures for data controllers and providers of AI systems as foreseen in the EU's General Data Protection Regulation (GDPR), the proposed EU Digital Services Act (DSA) and the proposed EU AI Act will help to break through various vicious circles, by constraining how people may be targeted (GDPR, DSA) and by requiring documented evidence of the robustness, resilience, reliability, and the responsible design and deployment of high-risk recommender systems (AI Act).

Environment kinesis and organisational adaptability: effects of EU's General Data Protection Regulation on the Danish software industry

Environment kinesis and organisational adaptability: effects of EU's General Data Protection Regulation on the Danish software industry

A Literature Review on the GDPR, COVID-19 and the Ethical Considerations of Data Protection During a Time of Crisis.

SummaryObjective: This survey article presents a literature review of relevant publications aiming to explore whether the EU's General Data Protection Regulation (GDPR) has held true during a time of crisis and the implications that arose during the COVID-19 outbreak. Method and Results: Based on the approach taken and the screening of the relevant articles, the results focus on three themes: a critique on GDPR; the ethics surrounding the use of digital health technologies, namely in the form of mobile applications; and the possibility of cross border transfers of said data outside of Europe. Within this context, the article reviews the arising themes, considers the use of data through mobile health applications, and discusses whether data protection may require a revision when balancing societal and personal interests. Conclusions: In summary, although it is clear that the GDPR has been applied through a mixed and complex experience with data handling during the pandemic, the COVID-19 pandemic has indeed shown that it was a test the GDPR was designed and prepared to undertake. The article suggests that further review and research is needed to first ensure that an understanding of the state of the art in data protection during the pandemic is maintained and second to subsequently explore and carefully create a specific framework for the ethical considerations involved. The paper echoes the literature reviewed and calls for the creation of a unified and harmonised network or database to enable the secure data sharing across borders.

Data protection and tech startups: The need for attention, support, and scrutiny

AbstractThough discussions of data protection have focused on the larger, more established organisations, startups also warrant attention. This is particularly so for tech startups, who are often innovating at the ‘cutting‐edge’—pushing the boundaries of technologies that typically lack established data protection best‐practices. Initial decisions taken by startups could well have long‐term impacts, and their actions may inform (for better or for worse) how particular technologies and the applications they support are implemented, deployed, and perceived for years to come. Ensuring that the innovations and practices of tech startups are sound, appropriate and acceptable should therefore be a high priority. This paper explores the attitudes and preparedness of tech startups to issues of data protection. We interviewed a series of UK‐based emerging tech startups as the EU's General Data Protection Regulation (GDPR) came into effect, which revealed areas in which there is a disconnect between the approaches of the startups and the nature and requirements of the GDPR. We discuss the misconceptions and associated risks facing innovative tech startups and offer a number of considerations for the firms and supervisory authorities alike. In light of our discussions, and given what is at stake, we argue that more needs to be done to help ensure that emerging technologies and the practices of the companies that operate them better align with the regulatory obligations. We conclude that tech startups warrant increased attention, support, and scrutiny to raise the standard of data protection for the benefit of us all.

Data Protection Commissioner v. Facebook Ireland Ltd. and Maximillian Schrems (C.J.E.U.)

On July 16, 2020, the Court of Justice of the European Union (CJEU) issued its ruling in Data Protection Commissioner v. Facebook Ireland Limited and Maximillian Schrems, commonly known as Schrems II, invalidating the EU–U.S. Privacy Shield as a valid transfer mechanism under the EU's General Data Protection Regulation (GDPR) and creating significant legal uncertainty for the continued availability of another widely used transfer mechanism, Standard Contractual Clauses (SCCs), for transfers of EU personal data from commercial entities in the EU to the United States. The widely anticipated ruling marked the second time in five years that the CJEU had invalidated the legal foundation for such data transfers, which in both cases had been the result of a carefully negotiated compromise balancing European data privacy concerns with statutory and constitutional limitations of the U.S. system (see Schrems I).

Risk and Rights in Transatlantic Data Transfers: EU Privacy Law, U.S. Surveillance, and the Search for Common Ground

Privacy advocates rightly view the Court of Justice of the European Union (CJEU) decision in Data Protection Commissioner v. Facebook Ireland, Ltd. and Maximilian Schrems (Schrems II) as a landmark. But one stakeholder's landmark is another's headache. The CJEU's decision invalidated the EU-U.S. Privacy Shield agreement governing transatlantic transfers of personal data. Citing U.S. surveillance law and practices, the CJEU found that data transfers lacked adequate privacy protections under the EU's General Data Protection Regulation (GDPR). The Schrems II decision thus clouded the future of data transfers that help drive the global economy. This Article offers a hybrid approach to safeguard privacy rights and ensure the viability of transatlantic data flows. The Article's hybrid approach is an alternative to two less promising ways of reading the CJEU's groundbreaking decision. The European Data Protection Board (EDPB) issued recommendations that took an absolutist view of Schrems II. For example, the EDPB rejects reliance on risk assessments that gauge the probability of U.S. surveillance of particular data. The EDPB insists on technical measures such as steep EU-centered encryption that thwart U.S. surveillance but also bar access for U.S. firms. This absolutist approach undermines the whole point of transatlantic data transfers. Another response to Schrems II takes a don't worry, be happy tack. Heralds of optimism assure audiences on both sides of the Atlantic that most transatlantic data transfers are immune as a matter of law from U.S. surveillance, including collection under § 702 of the Foreign Intelligence Surveillance Act (FISA) or Executive Order 12333 (EO 12333). Unfortunately for this optimistic turn, U.S. surveillance authorities are sufficiently broad to reach many communications by EU individuals. In particular, § 702's provision for collecting communications related to U.S. foreign affairs lacks any intelligible limiting principle or specific review of targeting decisions. The U.S. Foreign Intelligence Surveillance Court (FISC) does not approve every target under § 702, although it has the power to scrutinize targeting procedures. Collection under EO 12333 is even broader and not subject to FISC review. In sum, surveillance optimism is a rhetorical trope, not a legal strategy. Navigating between the EDPB's absolutist approach and the heralds' unfounded optimism, this Article proposes a hybrid model. The hybrid outlines a risk-assessment method based on U.S. export controls, which have successfully managed exports of sensitive technology for decades. This model can also be a template for managing transfers of sensitive personal data. In addition, the hybrid model proposes bolstering substantive and institutional safeguards in U.S. law. For example, the Article proposes an Algorithmic Rights Court (ARC) that would probe targeting decisions under both § 702 and EO 12333. Through more precise risk assessment and reinforced institutional and substantive protections, the hybrid model preserves privacy and supports a sustainable transatlantic data transfer regime.

The Difficulty of Defining Sensitive Data – the Concept of Sensitive Data in the EU Data Protection Framework

The concept of sensitive data has been a mainstay of data protection for a number of decades. The concept itself is used to denote several categories of data for which processing is deemed to pose a higher risk for data subjects than other forms of data. Suck risks are often perceived in terms of an elevated probability of discrimination (or related harms) to vulnerable groups in society. As a result, data protection frameworks have traditionally foreseen a higher burden for the processing of sensitive data than other forms of data. The sui generis protection of sensitive data (stronger than the protection of non-sensitive personal data) can also seemingly be a necessity from a fundamental rights-based perspective (as indicated by human rights jurisprudence). This paper seeks to analyse the continued relevance of sensitive data in both contemporary and potential future contexts. Such an exercise is important for two main reasons. First, the legal regime responsible for the regulation of the use of personal data has evolved considerably since the concept of sensitive data was first used. This has been exemplified by the creation of the EU's General Data Protection Regulation in Europe. It has introduced a number of requirements relating to sensitive data that are likely to represent added burdens for controllers who want to process personal data. Second, the very nature of personal data is changing. Increases in computing power, more complex algorithms and the availability of ever more potentially complimentary data online mean that more and more data can be considered of a sensitive nature. This creates various risks going forward, including an inflation effect whereby the concept loses its value and also the possibility that data controllers may increasingly seek to circumvent complying with the requirements placed upon the use of sensitive data. This paper analyses how such developments are likely to influence the concept of sensitive data and in particular its ability to protect vulnerable groups form harms. The authors propose a possible interpretative solution: a hybrid approach where a purpose-based definition acquires a bigger role in deciding whether data is sensitive combined with a context-based ‘backstop’ based on reasonable foreseeability.

Data protection during the coronavirus crisis.

Smartphone apps to track SARS-CoV 2 infections need to fulfill certain minimal requirements to guarantee privacy and justify their use under data protection laws.

Ensuring that the NHS realises fair financial value from its data

Ensuring that the NHS realises fair financial value from its data

The new EU cybersecurity framework: The NIS Directive, ENISA's role and the General Data Protection Regulation

The NIS Directive is the first horizontal legislation undertaken at EU level for the protection of network and information systems across the Union. During the last decades e-services, new technologies, information systems and networks have become embedded in our daily lives. It is by now common knowledge that deliberate incidents causing disruption of IT services and critical infrastructures constitute a serious threat to their operation and consequently to the functioning of the Internal Market and the Union. This paper first discusses the Directive's addressees particularly with regard to their compliance obligations as well as Member States’ obligations as regards their respective national strategies and cooperation at EU level. Subsequently, the critical role of ENISA in implementing the Directive, as reinforced by the proposal for a new Regulation on ENISA (the EU Cybersecurity Act), is brought forward, before elaborating upon the, inevitable, relationship of the NIS Directive with EU's General Data Protection Regulation.

The New EU Cybersecurity Framework: The NIS Directive, ENISA’s Role and the General Data Protection Regulation

The NIS Directive is the first horizontal legislation undertaken at EU level for the protection of network and information systems across the Union. During the last decades e-services, new technologies, information systems and networks have become embedded in our daily lives. It is by now common knowledge that deliberate incidents causing disruption of IT services and critical infrastructures constitute a serious threat to their operation and consequently to the functioning of the Internal Market and the Union. This paper first discusses the Directive's addressees particularly with regard to their compliance obligations as well as Member States’ obligations as regards their respective national strategies and cooperation at EU level. Subsequently, the critical role of ENISA in implementing the Directive, as reinforced by the proposal for a new Regulation on ENISA (the EU Cybersecurity Act), is brought forward, before elaborating upon the, inevitable, relationship of the NIS Directive with EU's General Data Protection Regulation.

Safe digital transformation for SMEs

The pressure is on for British businesses over the next couple of years. With the EU's General Data Protection Regulation (GDPR) now in force and Brexit looming, what can UK SMEs learn from their enterprise cousins during this profound period of transformation? Organisations are eagerly adopting digital transformation. Solutions such as containerisation and other cloud-based models allow greater flexibility while helping firms remain secure. These also address compliance and data sovereignty requirements, the need for greater business continuity in the event of a disaster (natural or otherwise) and improved accessibility to hardware and data. And for smaller firms, the assurance of colocation and the flexibility of cloud infrastructure strikes a good balance for their IT needs, says Jack Bedell-Pearce of 4D Datacentres.

Algorithms that remember: model inversion attacks and data protection law.

Many individuals are concerned about the governance of machine learning systems and the prevention of algorithmic harms. The EU's recent General Data Protection Regulation (GDPR) has been seen as a core tool for achieving better governance of this area. While the GDPR does apply to the use of models in some limited situations, most of its provisions relate to the governance of personal data, while models have traditionally been seen as intellectual property. We present recent work from the information security literature around ‘model inversion’ and ‘membership inference’ attacks, which indicates that the process of turning training data into machine-learned systems is not one way, and demonstrate how this could lead some models to be legally classified as personal data. Taking this as a probing experiment, we explore the different rights and obligations this would trigger and their utility, and posit future directions for algorithmic governance and regulation.This article is part of the theme issue ‘Governing artificial intelligence: ethical, legal, and technical opportunities and challenges’.